Suppose mining pool has been off the main network for a long time so that they are 100 or so blocks behind, but managed to mine 200 blocks in the period (say, some combination of had 33% before, deliberately selecting easy blocks to extend, and ...).
Obviously, this can happen by choking down the difficulty, but I'd assume there are protections against such an obvious attack as that one. Update: assumption verified; reducing the difficulty doesn't work here as expected.
I found two roughly similar questions, but neither seems right:
Can a double spend attack be obfuscated by mimicking the transactions seen before the fork?
Countrywide Internet isolation, inevitable fork
The obvious answer, if it contained only mined transactions, would be to manually discard it, but I don't think that assumption would prove valid.
I am bothered by the belief that this is a duplicate of longest chain vs. highest difficulty. Marking this as duplicate pre-supposes an entire class of cryptographic attacks on hashes does not exist, and many other things as well.
One possibility, as hinted by Murch, would be to pre-build a long chain, then using an attack on the hash take a few hours to construct a block with exactly a given hash. This may require waiting until an exceptionally vulnerable block appears but that doesn't really matter.
I finally guessed what a no-malice version might look like and I found this: Scenario: disaster splits the Internet into dozens unconnected fragments Basically, bad things happen if the largest connected network is << 50%.